Tenda Ac6 Firmware vulnerabilities

CVE-2025-46035 [HIGH] CWE-120 CVE-2025-46035: Buffer Overflow vulnerability in Tenda AC6 v.15.03.05.16 allows a remote attacker to cause a denial Buffer Overflow vulnerability in Tenda AC6 v.15.03.05.16 allows a remote attacker to cause a denial of service via the oversized schedStartTime and schedEndTime parameters in an unauthenticated HTTP GET request to the /goform/openSchedWifi endpoint

CVE-2025-55482 [HIGH] CWE-121 CVE-2025-55482: Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the formSetCfm function. Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the formSetCfm function.

CVE-2025-24496 [HIGH] CWE-288 CVE-2025-24496: An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulnerability.

CVE-2022-45641 [HIGH] CWE-120 CVE-2022-45641: Tenda AC6V1.0 V15.03.05.19 is vulnerable to Buffer Overflow via formSetMacFilterCfg. Tenda AC6V1.0 V15.03.05.19 is vulnerable to Buffer Overflow via formSetMacFilterCfg.

CVE-2025-55483 [HIGH] CWE-121 CVE-2025-55483: Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the function formSetMacFilterCfg vi Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the function formSetMacFilterCfg via the parameters macFilterType and deviceList.

CVE-2025-50528 [HIGH] CWE-121 CVE-2025-50528: A buffer overflow vulnerability exists in the fromNatStaticSetting function of Tenda AC6 <=V15.03.05 A buffer overflow vulnerability exists in the fromNatStaticSetting function of Tenda AC6 <=V15.03.05.19 via the page parameter.

CVE-2025-50641 [MEDIUM] CWE-120 CVE-2025-50641: Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the addWifiMacFilter function via th Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the addWifiMacFilter function via the parameter deviceId.

CVE-2025-55499 [MEDIUM] CWE-120 CVE-2025-55499: Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the ntpServer parameter Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the ntpServer parameter in the fromSetSysTime function.

CVE-2020-28095 [HIGH] CWE-835 CVE-2020-28095: On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the change On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the change password API will trigger the router to crash and enter an infinite boot loop.

CVE-2025-30256 [HIGH] CWE-772 CVE-2025-30256: A denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 A denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted series of HTTP requests can lead to a reboot. An attacker can send multiple network packets to trigger this vulnerability.

CVE-2022-45640 [HIGH] CWE-787 CVE-2022-45640: Tenda Tenda AC6V1.0 V15.03.05.19 is affected by buffer overflow. Causes a denial of service (local). Tenda Tenda AC6V1.0 V15.03.05.19 is affected by buffer overflow. Causes a denial of service (local).

CVE-2025-60338 [HIGH] CWE-787 CVE-2025-60338: Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the D Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the DhcpListClient function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2025-60342 [HIGH] CWE-787 CVE-2025-60342: Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the a Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the addressNat function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2025-60341 [HIGH] CWE-787 CVE-2025-60341: Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the ssid parameter in the f Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the ssid parameter in the fast_setting_wifi_set function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2025-44172 [MEDIUM] CWE-121 CVE-2025-44172: Tenda AC6 V15.03.05.16 was discovered to contain a stack overflow via the time parameter in the setS Tenda AC6 V15.03.05.16 was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function.

CVE-2025-57528 [HIGH] CWE-20 CVE-2025-57528: An issue was discovered in Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01 allowing attackers to caus An issue was discovered in Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01 allowing attackers to cause a denial of service via the funcname, funcpara1, funcpara2 parameters to the formSetCfm function (uri path: SetCfm).

CVE-2022-41485 [HIGH] CWE-120 CVE-2022-41485: Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in t Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x47ce00 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

CVE-2025-55495 [MEDIUM] CWE-120 CVE-2025-55495: Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the list parameter in t Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function.

CVE-2025-60337 [HIGH] CWE-787 CVE-2025-60337: Tenda AC6 V2.0 15.03.06.50 was discovered to contain a buffer overflow in the speed_dir parameter in Tenda AC6 V2.0 15.03.06.50 was discovered to contain a buffer overflow in the speed_dir parameter in the SetSpeedWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2025-25507 [MEDIUM] CWE-94 CVE-2025-25507: There is a RCE vulnerability in Tenda AC6 15.03.05.16_multi. In the formexeCommand function, the par There is a RCE vulnerability in Tenda AC6 15.03.05.16_multi. In the formexeCommand function, the parameter cmdinput will cause remote command execution.